CVE-2025-0928
BaseFortify
Publication date: 2025-07-08
Last updated on: 2025-08-26
Assigner: Canonical Ltd.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| canonical | juju | to 2.9.52 (exc) |
| canonical | juju | From 3.0.0 (inc) to 3.6.8 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Juju versions prior to 3.6.8 and 2.9.52 allows any authenticated controller user to upload arbitrary agent binaries to any model or to the controller itself without verifying model membership or requiring explicit permissions. This means that malicious users could distribute poisoned binaries to new or upgraded machines, potentially leading to remote code execution.
How can this vulnerability impact me? :
The vulnerability can lead to remote code execution on machines managed by Juju, as attackers can upload and distribute malicious binaries. This could compromise the integrity and security of your systems, allowing attackers to execute arbitrary code with potentially high impact on confidentiality, integrity, and availability.